=========================
 Login and Remote Access
=========================

When a user cannot log in on a system, it is usually caused by one of these:

1. The password is wrong.
2. Access hasn't been granted through Hiera (``aaa::admins`` and ``aaa::users``)
   or ``/etc/security/ssh.allow.*``. The latter also has to be enabled in Hiera.
3. Log in as root is attempted from a system that is not a bastion host (eg
   ``wmgt0*.psi.ch`` or ``*-gw.psi.ch``).
4. In the case of Gnome logins, the problem might be caused by the home
   directory being inaccessible (eg because AFS doesn't work properly).
5. :manpage:`sssd(8)` may have problems.

Regarding #3 note that on some systems the configured bastion host is
``wmgt*.psi.ch`` even though it is not actually possible to log in from there,
because the PSI firewall only allows connections from a certain gateway, eg
``foobar-gw.psi.ch``.


Notes
=====

For normal users there will be a :manpage:`pam_access(8)` error even for
successful logins. The reason is that we use pam_access twice. First for admins
and then - depending on the system's configuration - for normal users. Obviously
the first one will fail unless the user in question is recognized as an admin.
